CVM Computer System Validation & Software Testing Flashcards

What is the FDA's concept of 'predicate rule' in relation to 21 CFR Part 11?

Answer: The underlying regulation (e.g., 21 CFR Part 211) that requires the record to exist — Part 11 governs how it may be maintained electronically

The predicate rule is the underlying GMP/GLP/GCP regulation requiring a specific record; 21 CFR Part 11 applies when that record is maintained electronically.

In CSV, 'system retirement' or 'decommissioning' requires which of the following to protect data integrity?

Answer: A documented plan for data migration or archival to ensure records remain accessible throughout the retention period

When retiring a validated system, a decommissioning plan must ensure all GxP records are migrated or archived in a retrievable format for their required retention periods.

What does 'data integrity' mean in the context of GxP computerized systems, summarized by the ALCOA+ acronym?

Answer: Data that is Attributable, Legible, Contemporaneous, Original, and Accurate (plus Complete, Consistent, Enduring, Available)

ALCOA+ defines the attributes that GxP data must meet: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available.

Which testing approach in CSV involves testing the system without knowledge of the internal code or architecture, focusing on inputs and expected outputs?

Answer: Black-box testing

Black-box testing evaluates system behavior based on inputs and expected outputs without examining internal code, simulating the end-user perspective used in OQ and PQ.

What is the key deliverable produced at the end of a Computer System Validation project that summarizes all validation activities and conclusions?

Answer: Validation Summary Report

The Validation Summary Report compiles all validation activities, test results, deviations, and conclusions to formally declare the system validated and suitable for its intended use.

When a software update (patch or upgrade) is applied to a validated GxP system, which action is always required?

Answer: A documented change control assessment and appropriate regression testing proportional to the scope of the change

Software updates must go through change control with a risk-based impact assessment and targeted regression testing to confirm the validated state is maintained after the update.